Logout reopens the notifications stream without a token and gets a 401 #4395

Initial Checklist

• I understand this is a bug report and questions should be posted in the Community Discussions
• I searched issues and couldn’t find anything (or linked relevant results below)

Bug Description

Logging out in 7.2.4 caused no failed requests; on main the notifications SSE stream is reopened without a token right after logout and gets a 401, and after an auth error it keeps retrying every ~35 s on the Access denied page.

Console and network only.

Regression compared with OpenCloud 7.2.4 (web 7.1.5), found in the regression test before the release. Introduced by PR #2951 (d0410c0, resetSSE on user unload).

Cause: resetSSE() (authService.ts:539) nulls the SSE singleton, then Notifications.vue:298-307 (onUnmounted) calls clientService.sseAuthenticated.removeEventListener(); the getter (packages/web-pkg/src/services/client/client.ts:96) builds a new SSE adapter that connects at once with the cleared token.

Possible fix: Don't create a stream from teardown paths (use the existing adapter or none in removeEventListener), and don't open a stream without an access token.

Reproduction Steps

1. Log in, open a folder.
2. User menu > Log out (or force an auth error and stay on /access-denied).
3. Watch the network/console.

Expected Outcome

No failed request.

Actual Outcome

GET /ocs/v2.php/apps/notifications/api/v1/notifications/sse without Authorization → 401; on /access-denied it repeats every ~35 s.